Lab 4 · Over-Privileged Identity & Effective Access
Connect identity to data: find an automation user with full admin and trace which sensitive data it can reach.
Scenario tie-in
One 'automation' identity got
Action:* Resource:* and was reused everywhere.4.1 Find it
- Reports → Monitored Identities, filter AWS.
- Look for super admin / overprivileged policy.
4.2 Trace effective access
- Access Review → New Report; Type=File, Tags=sensitive.
- View Permissions; open Access Graph + Permission Summary.
4.3 Remediate
- DAC UI: Remove Entitlement / Remove from Group.
- Console: detach the inline admin policy, replace with a scoped one.
- Re-check Access Review.
Fresh-account note
Least-privilege recommendations key off 90+ day staleness, so some won't appear in a new account — use the console path.
Done when
The identity no longer has admin-over-everything, and DAC shows no effective access to the sensitive resources you checked.